CVE-2005-2781: Ilia Alshanetsky Fudforum

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.

Affected products

• Ilia Alshanetsky Fudforum: version 2.1.0 only; version 2.1.1 only; version 2.1.2 only; version 2.1.3 only; version 2.2.0 only; version 2.2.1 only; …

Published 2005-09-02. Last modified 2026-06-16.